4 Key Factors to Consider When Protecting Your Cloud Workloads
Blog Published: 02/06/2024
Originally published by CrowdStrike. Today’s security practitioners face a daunting challenge: Staying ahead of sophisticated adversaries who have turned their attention to the expansive terrain of cloud environments. CrowdStrike observed a 95% year-over-year increase in cloud exploitation in ...
What Are AWS Service Control Policies (SCP)? A Complete Guide
Blog Published: 02/09/2024
Originally published by Sonrai Security. Written by Tally Shea. The cloud is all about innovation at a speed never before possible. This can often lead to rapid development sprints and a proliferation of identities and infrastructure – and with that, excessive privilege. In large scale enter...
Detecting and Mitigating CVE-2023-4911: Local Privilege Escalation Vulnerability
Blog Published: 02/01/2024
Originally published by Sysdig.Written by Daniele Linguaglossa. Recently, Qualys discovered and reported a critical vulnerability affecting the popular GLIBC ecosystem, which is installed by default on most Linux-based operating systems. Specifically, a buffer overflow was found in the code r...
SOC 2 Reports and Penetration Tests
Blog Published: 02/02/2024
Originally published by MJD.Written by Mike DeKock, CPA. We get asked a lot about whether penetration testing is required to complete a SOC 2 report. The short version of the answer is “no” - there are no explicit requirements for penetration testing (or any controls) within a SOC 2 report. Th...
Key Management Lifecycle Best Practices: 3 Considerations to Be Aware Of
Blog Published: 02/02/2024
Written by the CSA Cloud Key Management Working Group.To implement key management solutions (KMS), it is important to understand the threats and risks facing your organization, as well as its regulatory and compliance needs. With increasing data use and storage risks, organizations must take m...
New Year, New Security Awareness Training—How to Implement a Role-Based Training Program
Blog Published: 02/08/2024
Originally published by BARR Advisory. Written by Larry Kinkaid, Manager, Cybersecurity Consulting, BARR Advisory. As we head into the new year, you might be thinking about your organization’s security and compliance goals. What will you be doing differently? What will remain the same? What d...
Getting a Handle on Your Crypto Assets to Prepare for PQC
Blog Published: 02/12/2024
Originally published by DigiCert. Written by Timothy Hollebeek.Quantum computing’s impending arrival is exposing what cryptography experts already know: Crypto is everywhere. Almost everything that implements modern security practices relies on cryptography and public key infrastructures (PKIs...
Part 1: Non-Human Identity Security – The Complete Technical Guide
Blog Published: 02/02/2024
Originally published by Astrix. Written by Michael Silva, Danielle Guetta, and Tal Skverer. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an e...
Part 2: How Attackers Exploit OAuth: A Deep Dive
Blog Published: 02/06/2024
Originally published by Astrix. Written by Michael Silva, Danielle Guetta, and Tal Skverer. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an e...
Feeding from the Trust Economy: Social Engineering Fraud
Blog Published: 02/12/2024
Originally published by Microsoft Security. In an increasingly online world, where trust is both a currency and a vulnerability, threat actors seek to manipulate human behavior and take advantage of people’s tendency to want to be helpful. In this infographic, we’ll explore social engineering ...
Ten Important CSPM Best Practices to Follow This Year
Blog Published: 02/07/2024
Originally published by ArmorCode.Cloud Security Posture Management (CSPM) refers to a set of tools and practices to ensure the security and compliance of cloud resources and workloads. CSPM tools help organizations identify and remediate cloud security misconfigurations, monitor compliance wi...
Starting Zero Trust Without Spending a Dime
Blog Published: 02/07/2024
Originally published by CXO REvolutionaries. Written by Brett James, Director, Field Product Management, Zscaler.Changing infrastructure is generally the first draw for any enterprise zero trust initiative, separating resources on the network that traditionally had carte blanche access to anyt...
Life During Wartime: Proactive Cybersecurity is a Humanitarian Imperative
Blog Published: 02/07/2024
Written by: Stan Mierzwa, M.Sc.; CISSP, Head Center for Cybersecurity & Lecturer, Kean University; President CSA NJ Chapter Diane Rubino, M.A.; Adjunct Assistant Professor, School of Professional Studies, New York University; Nonprofit Board Member.In brief:Humanitarian agencies responding...
FedRAMP Baseline Transition Points to OSCAL-Native Tools
Blog Published: 02/13/2024
Originally published by RegScale and MeriTalk. Until recently, FedRAMP (Federal Risk and Authorization Management Program) certification was an Executive Branch mandate, but now that it has become law, it legally stands between cloud service providers (CSPs) and government revenue.Further impa...
DevSecOps: 5 Tips for Developing Better, Safer Apps
Blog Published: 02/13/2024
Blurring the lines of security in application developmentOriginally published by CrowdStrike. According to the CrowdStrike 2023 Global Threat Report, there was a 95% increase in cloud exploits in 2022, with a three-fold increase in cases involving cloud-conscious threat actors. The cloud is ra...
The Return of the Notorious Qakbot Threat Campaign
Blog Published: 02/15/2024
Previous tactics from the dismantled QakBot Trojan now fuel wide-ranging phishing campaignsOriginally published by Skyhigh Security. Written by Rodman Ramezanian, Global Cloud Threat Lead, Skyhigh Security. Remember the QakBot cyberthreat (otherwise known as Qbot or Pinkslipbot)? This threat...
Uncovering Hybrid Cloud Attacks Through Intelligence-Driven Incident Response: Part 3 – The Response
Blog Published: 02/08/2024
Originally published by Gem Security.Written by Yotam Meitar. In the final section of this blog series on uncovering complex hybrid cloud attacks, we’ll share key elements of the response to the real-world sophisticated cloud attack outlined in Part 2. To protect the victim organization’s iden...
The Biggest Cloud Security Threats to Watch Out for in 2024
Blog Published: 02/09/2024
Originally published by Orca Security.Written by Bar Kaduri. It’s hard to believe that 2023 is nearing its end. As we look ahead to 2024, the Orca Research Pod has continued to examine attacker techniques and targets in cloud environments, as well as identify vulnerabilities and weaknesses tha...
Defining 12 CSA Research Topics
Blog Published: 02/09/2024
CSA Research is created by the industry, for the industry. Subject matter experts from a wide array of backgrounds and experiences volunteer for our working groups. Each of these working groups focuses on a unique topic or aspect of cloud security, including AI, IoT, DevSecOps, and much more. ...
Cloud Security Alliance Survey Finds 77% of Respondents Feel Unprepared to Deal with Security Threats
Press Release Published: 02/14/2024
Results highlight the importance of unified visibility across code-to-cloud environments to counter risks effectivelySEATTLE – Feb. 14, 2024 – A new survey and report on The State of Security Remediation from the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defi...
